Bug 2237903
| Summary: | Noobaa fails to use the new internal cert after rotation | |||
|---|---|---|---|---|
| Product: | [Red Hat Storage] Red Hat OpenShift Data Foundation | Reporter: | Andy Bartlett <andbartl> | |
| Component: | Multi-Cloud Object Gateway | Assignee: | Jacky Albo <jalbo> | |
| Status: | CLOSED ERRATA | QA Contact: | Tiffany Nguyen <tunguyen> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 4.12 | CC: | aprinzse, dzaken, ebenahar, etamir, gizzi, jalbo, kbg, nbecker, odf-bz-bot, rafrojas, sburke, tunguyen | |
| Target Milestone: | --- | Flags: | andbartl:
needinfo-
|
|
| Target Release: | ODF 4.15.0 | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | 4.15.0-83 | Doc Type: | Bug Fix | |
| Doc Text: |
.Multicloud Object Gateway failing to use the new internal certificate after rotation
Previously, Multicloud Object Gateway (MCG) client was not able to connect to S3 using the new certificate unless the MCG endpoint pods were restarted. Even though the MCG endpoint pods were loading the certificate for the S3 service at the start of the pod, the changes in the certificate were not watched, which means that rotating a certificate was not affecting the endpoint till the pods were restarted.
With this fix, a watch to check for the changes in certificate of the endpoint pods are added. As a result, the pods load the new certificate without the need for a restart.
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 2259839 2268410 (view as bug list) | Environment: | ||
| Last Closed: | 2024-03-19 15:23:18 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 2246375, 2259839, 2268410, 2268412 | |||
|
Description
Andy Bartlett
2023-09-07 15:46:09 UTC
Verified with build 4.15.0-144. After deleted secret "noobaa-s3-serving-cert", new secret is created and certificate is rotated and updated in noobaa-endpoint pod. Certificate is updated using below command:
$ openssl s_client -connect localhost:6443 -showcerts 2>/dev/null </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text -noout
...
< Not Before: Feb 20 03:09:18 2024 GMT
< Not After : Feb 19 03:09:19 2026 GMT
---
> Not Before: Feb 20 22:43:16 2024 GMT
> Not After : Feb 19 22:43:17 2026 GMT
...
*** Bug 2269032 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: Red Hat OpenShift Data Foundation 4.15.0 security, enhancement, & bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2024:1383 |